Merge lp:~julian-edwards/maas/1.2-xss-bug-1251336 into lp:maas/1.2

[Julian Edwards]

Fix XSS in API calls that have no valid operation.

[Julian Edwards (julian-edwards)]

Selfing. Approved on trunk.

review: Approve

=== modified file 'src/maasserver/api.py'
--- src/maasserver/api.py	2013-10-04 13:47:09 +0000
+++ src/maasserver/api.py	2014-02-06 03:16:07 +0000
@@ -109,7 +109,6 @@
 from django.http import (
     Http404,
     HttpResponse,
-    HttpResponseBadRequest,
     QueryDict,
     )
 from django.shortcuts import (
@@ -307,7 +306,7 @@
         signature = request.method.upper(), request.REQUEST.get("op")
         function = self.exports.get(signature)
         if function is None:
-            return HttpResponseBadRequest(
+            raise MAASAPIBadRequest(
                 "Unrecognised signature: %s %s" % signature)
         else:
             return function(self, request, *args, **kwargs)

=== modified file 'src/maasserver/tests/test_api.py'
--- src/maasserver/tests/test_api.py	2013-07-25 14:26:49 +0000
+++ src/maasserver/tests/test_api.py	2014-02-06 03:16:07 +0000
@@ -280,6 +280,17 @@
         self.assertThat(observed, MatchesListwise(expected))
 
 
+class TestXSSBugs(TestCase):
+    """Tests for making sure we don't allow cross-site scripting bugs."""
+
+    def test_invalid_signature_response_is_textplain(self):
+        response = self.client.get(
+            reverse('nodes_handler'),
+            {'op': '<script>alert(document.domain)</script>'})
+        self.assertIn("text/plain", response.get("Content-Type", None))
+        self.assertNotIn("text/html", response.get("Content-Type", None))
+
+
 class TestStoreNodeParameters(TestCase):
     """Tests for `store_node_power_parameters`."""
 
@@ -591,7 +602,7 @@
             })
 
         self.assertEqual(httplib.BAD_REQUEST, response.status_code)
-        self.assertIn('text/html', response['Content-Type'])
+        self.assertIn('text/plain', response['Content-Type'])
         self.assertEqual(
             "Unrecognised signature: POST None",
             response.content)

=== modified file 'src/maasserver/views/combo.py'
--- src/maasserver/views/combo.py	2012-06-29 10:04:44 +0000
+++ src/maasserver/views/combo.py	2014-02-06 03:16:07 +0000
@@ -95,7 +95,9 @@
             return HttpResponseRedirect(
                 "%s%s" % (default_redirect, fnames[0]))
         else:
-            return HttpResponseBadRequest("Invalid file type requested.")
+            return HttpResponseBadRequest(
+                "Invalid file type requested.",
+                content_type="text/plain; charset=UTF-8")
         content = "".join(
             [content.decode(encoding) for content in combine_files(
                fnames, location, resource_prefix='/', rewrite_urls=True)])